18:07:10 #startmeeting 18:07:10 Meeting started Mon Dec 14 18:07:10 2020 UTC. The chair is bmwiedemann. Information about MeetBot at http://wiki.debian.org/MeetBot. 18:07:10 Useful Commands: #action #agreed #help #info #idea #link #topic. 18:07:37 #topic introductions 18:08:01 * bmwiedemann is Bernhard M. Wiedemann (SUSE / Germany) 18:08:14 * lamby is Chris Lamb (UK) 18:08:43 * cbaines is Chris Baines (also UK) 18:09:14 hey bmwiedemann, cbaines 18:11:04 Yo, Morten Linderud (Arch / Norway) 18:12:12 (I still hope for vagrantc as he was active just 15 minutes ago) 18:14:09 Hi everybody. 18:14:14 hi jathan 18:14:20 hey all, sorry, had some unexpected surprises this morning 18:15:12 * vagrantc = Vagrant Cascadian 18:15:13 Hope all is well 18:16:04 #topic discuss vision of reproducible builds 18:16:10 #link https://pad.sfconservancy.org/p/reproducible-builds-vision 18:17:32 Hi lamby! 18:18:00 vagrantc: I hope everything is fine. 18:18:21 lamby or vagrantc: want to take over? This is not a good time for me. 18:19:13 I'm probably not the best to take this (wasn't involved in the previous meeting, for example) 18:19:22 some people clearly put some thought into this, thanks bmwiedemann, kpcyrd and cbaines ! 18:20:58 I've only been adding some things in the past 20 minutes 18:21:40 so, looks like the bulk of the topics were distro-specific next steps and very long term goals 18:22:29 also of note, the topic of cross-distro bootstrappability :) 18:22:59 the notes I wrote are somewhat short/near term, I'm careful with long term decisions while there's still short term stuff to figure out :) 18:23:06 there are a few overarching topics we worked on in the past such as SOURCE_DATE_EPOCH, disorderfs and diffoscope. What will the future have in that direction? 18:23:21 kpcyrd: fair enough :) 18:24:09 While writing up notes, I remembered about https://ismypackagereproducibleyet.org/ I think I had a plan to get Guix data in to that at one point. Anyway, I like the idea of viewing data from different distros in one place. 18:24:30 for example, I'd like to see rebuilders and rebuilder backends mature first before we settle on a report format. it's easier to rewrite stuff without carrying the report code around yet. 18:28:28 bmwiedemann: well, i think BUILD_PATH_PREFIX_MAP is ... mostly stalled indefinitely, but at some point that could be resurrected. although maybe build paths are not a priority; relatively easy to normalize 18:29:23 re 18:29:39 i was also intrigued by the idea of various "rings" of package sets ... somewhat similar to debian's various package sets 18:30:08 #link https://tests.reproducible-builds.org/debian/bullseye/amd64/index_pkg_sets.html 18:30:46 Like, generic, distribution-agnostic rings? 18:31:28 could be something to explore ... if we're all putting energy into fixing "core" reproducibility issues, we might all get there faster ... though some of those are the hardest 18:32:08 nod 18:33:51 i don't know if it makes sense to try and schedule something like a targeted week of hacking on packages we identify as "core" issues for reproducibility across distros? 18:34:09 i'd think it first makes sense to identify them :) 18:34:18 or maybe thats the first bit of that hacking week 18:34:39 well, like the link i posted above probably identifies some issues from a Debian perspective ... 18:35:14 and if other distros have similar lists to share, we can compare notes, trade patches and try to get them upstream... 18:35:24 * h01ger nods 18:36:25 although i think binutils and gcc in debian are possibly mostly of maintainer embedding known unreproducible build logs :( 18:37:20 i think for a lot of the "make a distro fully reproducible" goals, rebuilders seem to be core to that, though each distro has specific challenges there 18:37:40 but i guess maybe also coming to agreement on a known set of variations/normalizations? 18:38:34 but once we have the core bootstrap, cross-distro bootstrapping might become more feasible :) 18:39:22 it still has the same challenges of incompatible versions, but at least we can expect reproducible results then. 18:39:40 right 18:41:01 something like Guix could come in handy for the cross-distro bootstrapping, because (If I understood it correctly) can be built on different distributions and might be able to bootstrap different parts of various distributions 18:41:11 oh, nice :) 18:41:41 personally cross-anything is outside my vision(s) currently. its so far out and we have so so many smaller and already caught fish to fry 18:42:00 but hey, scratch your itches :) 18:42:09 true, it is more in the bootstrappable region 18:42:46 i was also wondering ... how well known is reproducible builds in the world at large? it seems to be increasingly common amoung software development circles ... and sometimes in security circles ... but i also surely have a biased view 18:43:20 and ... is there more we can do to ... get the word out? 18:43:39 we've historically given lots of talks at many conferences ... which is a little different right now 18:43:41 government regulations on software ? 18:44:08 vagrantc: well, we've given talks this year too. and 2019 is not really 'historic' 18:44:36 you know, there was the FSFE campaign for "public money, public code" - that could be built upon, to encourage/sponsor/demand reproducible builds of that FLOSS code 18:45:11 * h01ger believes that parts of the german tech scene now reproducible builds, because when last week the free'ed version of the corona warn app was released, two features were noted: a.) free of google services b.) reproducible builds 18:45:27 h01ger: that's great! 18:45:30 bmwiedemann: i believe r-b is part of their campaign 18:45:51 (and s#now#know# in the last but one line from me) 18:46:34 h01ger: google doesnt find such claim. 18:47:04 * h01ger checks his inbox 18:49:01 I found one FSFE r-b mention in our weekly report #198 18:49:08 about Huawei+5G 18:51:21 I guess, that part of r-b vision could be part of a wider vision of FLOSS adoption (or even requirement) in certain sectors 18:52:26 I need to jump off now for a bit :) 18:52:32 bmwiedemann: you're right, i only found random people demanding public code should be reproducible 18:52:33 lamby: thanks for dropping in 18:52:37 lamby: o/ 18:53:28 i've had a talk or two begging the question "is it really free software if it isn't reproducible" ... maybe nudging that angle a little over the coming years could be interesting 18:53:54 although want to be careful not to get too adversarial 18:54:06 * h01ger has been asking that question since 3-4 years at least :) 18:54:34 I remember something from Marrakesh about Huawei and the UK 5G stuff. I think there was some aspect of the customer reproducing the vendors artifacts there for security reasons. 18:54:42 I think, we want to shift people's thinking in that direction. Proper FLOSS software should build reproducibly. 18:55:29 cbaines: https://www.huawei.com/en/press-events/news/2019/12/huawei-ma5800-code-evaluation-build-engineering-assessment <- page 4 18:55:48 i had a never presented talk basically about the interplay between FLOSS, reproducible builds and bootstrappability making each stronger 18:56:38 For Guix at least, I see a clear step from the current state of "fetch a binary thing if the hash is signed and I trust the key" to "fetch a binary thing if the hash is signed by N signatures where N > 1", which will provide more security to users (providing things build reproducibly) 18:56:40 it did occur to me that we could just give talks and self-publish them, rather than waiting for a conference 18:57:04 a question on timing: do we need to wrap up, or should we continue until the topic (or the people) are exhausted 18:57:21 cbaines: yeah, seems like guix is well poised to be the first to implement the end-user parts 18:57:39 * h01ger has to prepare food now, so i'll drop out. 18:57:40 h01ger, thanks 18:57:48 #idea record presentations outside of conferences 18:58:14 #idea connect with publiccode.eu about reproducible builds 18:58:51 # broadly government initiatives incorporating reproducible builds 18:58:56 #idea broadly government initiatives incorporating reproducible builds 18:59:06 * vagrantc hopes #idea works 18:59:28 #save 18:59:31 #idea guix could implement substitutes with N matching signatures 18:59:49 bmwiedemann: we should probably wrap up 19:00:03 was trying to record some of the ideas as we went in the meetbot summary 19:00:07 There's a link for that 19:00:10 #link https://lists.gnu.org/archive/html/guix-devel/2020-06/msg00179.html 19:01:00 #idea hack sessions to target specific core packages 19:02:20 well, shall we call it? 19:02:37 bmwiedemann: i think you have the power to end this :) 19:02:44 alright. we had a nice meeting. thanks all for the contributions. 19:02:54 thanks everyone! 19:03:08 #endmeeting